The present invention relates generally to methods and systems for authenticating an electronic identity assertion, with a very high confidence that the asserted electronic identity belongs to the person who is asserting it, as opposed to someone who is attempting to pose as another.
User names and passwords are a ubiquitous way to provide a minimal level of authentication to a computer user seeking to access a system provided to a network of computers such as the World Wide Web (WWW) or to a similar local network. For instance, typical online banking systems require users to log on to a Web server belonging to a financial institution using a user name and password that have been previously given to the user by the institution. In this way, only a user (hopefully, the true account owner) who possesses both the user name and the password can gain access to that user's account.
In another example, subscription services and sales are often provided via the WWW. For instance, users can subscribe to Web sites to receive news, music, movies, and the like and to purchase almost anything. To ensure that only users who have paid (or will be subsequently be charged for) the subscription fee and/or services can access the content or purchase the goods or services, a user seeking access is required to log in using a user name and password.
In either case, it is possible that a password can be stolen and information and products/services/money intended only for the rightful owner of the password can consequently fall into the hands of a password thief.
And the problem is getting worse. As was recently noted in the Wall Street Journal (Feb. 2, 2009, “The Menace in the Machines: Cyber-Scams On The Uptick In Downturn”),                “The bear economy is creating a bull market for cyber-crooks. Avivah Litan, vice president with Internet-technology research company Gartner Inc, said clients are telling her that cyber-assaults on many banks have doubled in the past six months in the U.S. and other parts of the world, including the U.K., Canada, Mexico aid Brazil. Though most are thwarted by computer-security defenses, such as spam filters and fraud-detection systems that still leaves potentially millions of victims.        ‘They are all experiencing a lot more attacks, and a lot more ATM fraud’ aimed at depositors' accounts, Ms. Litan said.        More than 800 complaints have been logged by the National White Collar Crime Center in Richmond, Va., so far this year from checking-account customers in the U.S. about mysterious, unauthorized transactions of $10 to $40 that appear on monthly statements. Craig Butterworth, a spokesman for the center, a federally funded group that assists police agencies, said investigators suspect a data breach or ‘phishinig’ campaign, where deceptive emails and text messages are used to acquire personal information, such as Social Security numbers, user names and passwords.        The FBI's Internet Crime Complaint Center confirms an increase in cyber-attacks. In its most recent Internet Crime Report, the FBI said it received 207,000 complaints about crimes perpetrated over the Internet in 2007, the latest year for which data is available, amounting to nearly $240 million a year earlier.”        
To ameliorate this problem and minimize the risk of this threat, some institutions have shifted to the implementation of single token, multi-factor authentication solutions using multi-factor cryptographic tokens or multi-factor one-time password devices. Such solutions, which are well known in the art, have heretofore depended upon the costly and cumbersome-distribution of a card or a token to the end users. In the multi-factor cryptographic token and multi-factor one-time password solutions, these deployments face additional challenges because the proper implementation requires a cryptographic key release from the device based upon the use of a password associated with that device. Such devices are costly, and implementations are time consuming and logistically cumbersome to deploy and manage especially for large-scale heterogeneous user-bases. NIST Special Publication 800-63-1, Electronic Authentication Guideline, Dec. 8, 2008, provides technical guidelines for implementing various electronic authentication methods and systems and is incorporated by reference.